Unnamed service

Deterministic remediation risk gate. Pass actor, sector, region, planned_action (e.g. block_ip, halt_pipeline, disable_account). Returns auto_approve/human_review/reject via capability x opportunity x intent scoring (same as /ot/threat-score) — no LLM in the loop. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Optional asset_context escalates to human_review on shared cloud/CDN infra (e.g. shared_infra:cloudflare).

Resource: ot-intel-api.onrender.com/ot/action-conformance

Network: eip155:8453 · Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · Pay to: 0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B

Payment methods: — · Last validation: 2026-09-14 11:09:53.319+00

{
  "input": {
    "type": "object",
    "required": [
      "type",
      "method"
    ],
    "properties": {
      "type": {
        "type": "string",
        "const": "http"
      },
      "method": {
        "enum": [
          "GET"
        ],
        "type": "string"
      },
      "queryParams": {
        "type": "object",
        "required": [
          "actor",
          "sector",
          "region",
          "planned_action"
        ],
        "properties": {
          "actor": {
            "type": "string",
            "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
          },
          "region": {
            "type": "string",
            "description": "Target region e.g. GCC, KSA, UAE, Europe"
          },
          "sector": {
            "type": "string",
            "description": "Target sector e.g. energy, water, manufacturing"
          },
          "vendor_stack": {
            "type": "string",
            "description": "Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds the underlying threat-score's capability leg, same as /ot/threat-score. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review even if the underlying score would otherwise clear the auto-approve threshold."
          },
          "asset_context": {
            "type": "string",
            "description": "Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected"
          },
          "planned_action": {
            "type": "string",
            "description": "One of: block_ip, block_domain, quarantine_host, isolate_segment, halt_pipeline, disable_account"
          }
        }
      }
    },
    "additionalProperties": false
  },
  "output": {
    "type": "object",
    "required": [
      "type"
    ],
    "properties": {
      "type": {
        "type": "string"
      },
      "example": {
        "type": "object"
      }
    }
  },
  "paymentRequirements": [
    {
      "raw": {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "120000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      },
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
      "scheme": "exact",
      "network": "eip155:8453",
      "amountAtomic": "120000"
    }
  ]
}

Source catalog records are retained separately from live endpoint observations. Sonar score, uptime, and latency are advisory metrics. CDP indexing is not inferred from validation.